Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10.

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/ravenmessage.py that skip the workspace membership check. Authenticated non-members can call getmessageswithdates or getallfilessharedinchannel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.